AdultFriendFinder network finally comes clean to members about hack
 

zdnet.com/article/adultfriendfinder-finally-comes-clean-with-users-about-site-hacks/

(still cant post direct links until I hit 30 posts)

As a company, how long should you wait until you send a client-wide email about your breach?

If it were up to me, I'd send it as soon as I saw some fishy/phishy activity. Better to be on top of the issue rather than lose face IMO.

ASAP but your own first investigations never reveal extent of hacking more problems arise and generally need to show effort to rectify problem before announcing.

I think this is also a good way to show that you (the company) is working to solve the issues via social media etc. At least keep the clients posted on whats going on.